A real audit of a B2B website
Audited September 19, 2026. 25 pages analyzed, overall score 62/100. Only the names were changed.
These PDFs are samples of the audit report, not of the full delivery.
A full order includes three PDFs: the audit report, the page-by-page analysis and the methodology note.
The report's verdict
The site has first-rate encryption and strong industry content, but mobile visitors wait close to twenty seconds for the home page, and ad trackers fire before anyone consents: one technical project, one legal one.
These passages are copied from the report, word for word.
What weighs most on the score
- Trackers before consent: on first load, before any visitor action, the site sets
_ga,_ga_QV7XXENXML,_fbp,hubspotutk,__hstc,__hsscand__hssrc, and contacts 29 third-party domains, includinggoogle-analytics.com,facebook.net,doubleclick.netandpx.ads.linkedin.com. - Very slow main content on mobile: the home page shows its main element after 8.3 seconds, against a 4-second threshold. Loaded three times under crawl conditions, the same page takes 25.3 to 25.5 seconds: the slowness is reproducible.
- Data outside the EU and independence: eleven Google, Meta and LinkedIn domains receive visitor IP addresses; Webflow hosts the site on Amazon Web Services in San Francisco; one provider holds both the domain registration and its DNS.
- Visible placeholder text:
/produits/atlas-intelligenceshows “No items found.” in a gray band below the first screen. - Untranslated content: the
/mentions-legalespage of the French version is written in English; it matches the English version heading for heading. - Unprotected cookies: the four HubSpot cookies, including the
hubspotutkvisitor ID, are set without theSecureandHttpOnlyflags. - Reliability: a JavaScript exception occurs on load on the four
/ressourceslist pages, and a third-party tracker returns a 400 error on every page. - DNSSEC not deployed and a two-hop redirect chain from
http://kelvo.example/.
What needs fixing
- Home page main content at 8.3 s on mobile, more than 25 s under crawl conditions; 17 of 25 pages under 50 for speed; up to 13.1 s of total blocking time per page.
- 29 third-party domains and 8 cookies before any choice, with no refuse button on the first screen, contrary to what the cookie policy states.
- Client testimonials that change text and author from page to page; “No items found.” shown on the product page; a legal notice written in English on the French version.
What already works
- First-rate encryption: only TLS 1.2 and TLS 1.3 are accepted, two valid certificates, HSTS enabled, no insecure content on any of the 25 pages.
- Signed and dated industry content: four 2026 articles on order processing, with figures and arguments; a named leadership team and expert board.
- Automated accessibility at 88/100: the focus indicator is visible everywhere, and each defect found is fixed once in the template.
The score for each pillar
| Pillar | Score | Weight in the overall score |
|---|---|---|
| Security & encryption | 80/100 | 10% |
| Performance | 30/100 | 18% |
| SEO & search visibility | 75/100 | 18% |
| Accessibility | 88/100 | 10% |
| Compliance & privacy | 57/100 | 12% |
| Domain & network | 72/100 | 4% |
| Independence & resilience | 47/100 | 8% |
| Content & trust | 65/100 | 10% |
| User experience & reliability | 65/100 | 10% |
Pillar by pillar
Each pillar in the report opens with a summary written for a non-technical reader. Here it is for all nine, copied from the report, with the guides that explain the findings.
Security & encryption: 80/100
In brief: the site is not vulnerable, but it is not fully hardened. Encryption is at the top level, and the served code contains no vulnerable library and no secret. Four browser protection headers are missing, and the HubSpot cookies, which identify the visitor, lack the flags that protect them. These are settings, not development work: a few hours are enough.
Guides that explain these findings:
Performance: 30/100
In brief: this is the costliest issue on the site. On mobile, the home page takes 8 to 25 seconds to show its main content depending on conditions, and 17 of the 25 pages score under 50. On desktop, the same pages load in 1 to 2.3 seconds. So the problem sits on the phone, and it comes mainly from JavaScript: every page blocks the processor for 10 to 13 seconds. Start here.
Guides that explain these findings:
SEO & search visibility: 75/100
In brief: the foundation is in place - sitemap, robots.txt, complete and reciprocal language declarations, and content served directly by the server. Four template defects cost points across the whole site: no canonical URL, no structured data, a footer logo that links to a missing page, and four sales pages that no link reaches. These are template fixes: few in number, broad in effect.
Guides that explain these findings:
Accessibility: 88/100
In brief: the site's best pillar. The focus indicator - the mark that shows where you are when you navigate with a keyboard - is visible everywhere, which is rare. The defects come from the template, and each is fixed once: there is no skip link, the Escape key does not close the language menu, and the same gray, too light on white, is used for the breadcrumb, article summaries, and the job titles of authors and quoted clients, on 17 pages. Nothing here is urgent.
Compliance & privacy: 57/100
In brief: this is the most urgent issue. The site fires its advertising and analytics trackers before the visitor chooses anything, and its banner does not make refusing as easy as accepting. The legal notice is almost complete, but the privacy policy describes a setup that is not the site's own, on five points. The fix is in the consent manager and tag manager settings; it should come before any paid acquisition campaign.
Domain & network: 72/100
In brief: the setup is sound, and the domain runs until May 2027. Three settings are missing, none urgent: DNS answers are not signed, no record limits which authorities may issue a certificate, and the email anti-spoofing policy quarantines instead of rejecting.
Guides that explain these findings:
Independence & resilience: 47/100
In brief: the site sends visitor IP addresses to eleven domains outside the EU, all owned by Google, Meta or LinkedIn, and it is hosted in the United States. One provider holds both the domain registration and its DNS. These are architecture choices, not setting errors: they call for a decision, and the privacy policy must then describe what the site actually does.
Guides that explain these findings:
Content & trust: 65/100
In brief: the content is abundant, signed and dated, and the 2026 articles on order processing are genuinely specific. Three reservations: five 2024-2025 articles could come from any vendor; the product page shows an empty-template message; and above all, client testimonials change from page to page - text shared between clients, job titles and names that vary. The last point is a content fix, and it affects the argument a prospect checks first.
Guides that explain these findings:
User experience & reliability: 65/100
In brief: the site works and reads well on all three screen sizes. Three reliability defects recur on several pages: a JavaScript exception on the list pages, a third-party tracker that fails on every page, and a footer logo that links to a missing page. The navigation leads neither to the product page nor to the case studies: a visitor looking for references finds them only through the blog.
Guides that explain these findings:
Read the report (opens in a new tab)